Upload
others
View
17
Download
0
Embed Size (px)
Citation preview
UVM-based RISC-V processor verification platform
Tao Liu, Richard Ho, Udi Jonnalagadda
● Motivation
● What makes a good instruction generator
● Random instruction generation flow
● RTL and ISS co-simulation flow
● Benchmark
● Future work
Agenda
Open source RISC-V processor verification solutions
riscv-testsAssembly unit testA simple test framework focused on sanity testing the basic functionality of each RISC-V instruction. It’s a very good starting point to find basic implementation issues.
riscv-tortureScala-based RISC-V assembly generatorProvides a good mix of hand-written sequences. Supports most RISC-V ISA extensions which makes it very attractive. Simple program structure and fixed privileged mode setting.
Verification is one of the key challenges of modern processor development.
Many missing pieces
● Complex branch structure● MMU stress testing● Exception scenarios● Compressed instruction support● Full privileged mode operation
verification ● Coverage model● ...
MotivationBuild a high quality open DV infrastructure that can be adopted and enhanced by DV engineers to improve the verification quality of RISC-V processors.
Why SV/UVM
SystemVerilog (SV)Most popular verification language, provides great features like constrained random, coverage groups etc.
Universal Verification Methodology (UVM)Most prevalent verification framework in the industry
We want to build something with the industry standard verification language and framework which most DV engineers can easily understand and extend.
What makes a good instruction generator
01Randomness
Randomize everything: instruction, ordering, program structure, privileged mode setting, exceptions..
02Architecture-aware
The generated program should be able to hit the corner cases of the processor architectural features.
04Extendability
Easy to add new instruction sequences, custom instruction extension, custom CSR etc.
03Performance
The instruction generator should be scalable to generate a large program in a short period of time.
Randomness
Instruction level randomizationCover all possible operands and immediate values of each instructionExample: Arithmetic overflow, divide by zero, long branch, exceptions etc.
Sequence level randomizationMaximize the possibility of instruction orders and dependencies
Program level randomizationRandom privileged mode setting, page table organization, program calls
DIV Branch Load Fence StoreSHIFT
Instruction randomization
Easy part
Arithmetic: ADD, SUB, LUI, MUL, DIV ...Shift: SLLI, SRL, SRLI, SRAI …Logical: XOR, OR, AND, ANDI …Compare: SLTI, SLT, SLTU …Others: FENCE, SFENCE, EBREAK ...
Randomize each instruction individually with bias towards corner cases.(overflow, underflow, compressed instruction)
Tricky part
Branch / jump instructionNeed a valid branch/jump target Avoid infinite loop
Load/store/jump instructionNeed an additional instruction to setup the base addressThe calculated address should be a valid location
CSR instructionAvoid randomly changing the privileged stateResult checking could be a challenge as the privileged CSR behavior could be implementation-specific.
Load/store instruction generation
la x10, data_labellw x11, x10, 20
la x10, data_labeladd x12, x13, x14xor x14, x5, x6lw x11, x10, 20
A basic load/store instruction needs additional instruction to setup the base address (rs1)
Mix the atomic instruction stream with other irrelevant instructions to improve instruction order combination coverage
Basic load/store instruction
Similar atomic instruction streamJAL/JALRStack push/pop operationsLoop structure
Forward branch
Branch instruction generation
Randomly pick a forward targetAvoid step into the atomic instruction
stream
12345
67
OK
OK
Not allowed
Mostly OK
Atomic instruction
stream
Backward branchA dedicated instruction stream to properly
setup loop structure, make sure the loop exit condition can be triggered
Init loop counter register
… ...
Init loop limit register
… ...
… ...
… ...
Update loop counter register
… ...
Backward branch instruction
Call stack randomization
A A B
A B N...
Avoid loop function call
Main
Sub1 Sub2 Sub3 Sub4
Sub5 Sub6 Sub7
Subn
Generate call stack in a tree structure
Page table randomization
PPN2 PPN1 PPN0 PPN2 PPN1 PPN0
PPN2 PPN1 PPN0
PPN2 PPN1 PPN0 PPN2 PPN1 PPN0
PPN2 PPN1 PPN0
PPN2 PPN1 PPN0... ... ...... ... ...
PPN2 PPN1 PPN0... ... ...... ... ...
PPN2 PPN1 PPN0... ... ...... ... ...
Example: SV39 page table randomization (with exception injection)
4KB
!
!
!
Root table (1GiB) Level 1 page (2MiB) Level 0 page (4KiB)
Architecture aware
01 Branch prediction 02 MMU (TLB, Cache etc)
Code segment 0
Code segment n
Code segment k
Data page 0Data page 1Data page 2Data page 3Data page 4Data page 5Data page 6Data page 7Data page 8Data page 9Load
Store
Jump
Jump
BHT
AddressTAG
Prediction bits
M
U
U
Trap handlerS
Trap
Instruction
Architecture aware
03 Issue, execute, commit
It’s not just a random stream of instructions, it should be designed to effectively verify the architectural features of the processor.
R3
Generator flow
Generate program header
Privileged mode setup
Page table randomization
Initialization routine
Generate main/sub programs
Branch target assignment
Generate data/stack section
Generate page tables
Generate intr/trap handler
Test completion section
Call stack randomization
Apply directed instructions
Memory mapAll instructions and data are located in continuous physical address space, and are mapped to the virtual address space through page table.
Initialization routine
Main program
Sub program 0
… ...
Sub program n
Interrupt handler
ECALL handlerException handler
Data page 0
Data page n
….
Stack section
Instruction
Data
Stack
reset entry
Page table 0
Page table n
... Page table
satp
RTL & ISS co-simulation flow
UVM random instruction generator
RISC-V compiler
RISC-V ELF
Link script
RISC-V assembly
RISC-V ISS(spike)
ISS sim log
RISC-V plain binary
RISC-V Processor
DUT
Memory model
RTL sim log
Logcompare
objcopy
RTL simulation environment
Complete feature list
Test suite
Basic arithmetic instruction test
Random instruction test
MMU stress test
Page table exception test
HW/SW interrupt test
Branch/jump instruction stress test
Interrupt/trap delegation test
Privileged CSR test
Supported ISARV32IMC, RV64IMC
Supported privileged modeUser mode, supervisor mode, machine mode
Supported spec versionUser level spec 2.20, privileged mode spec 1.10
Supported RTL simulatorVCS, Incisive
Benchmark flow
Pulpino RI5CY:4 stages, RV32-IMC, DSP extensionPulpino Ariane :6-stage, RV64-IMC, single issue, in-order, support M/S/U privileged levelsMerlin:Open Source RV32I[C] CPU
Ariane core architecture
Processor candidates
Benchmark metrics
Bug hunting capability, test coverageFlow integration effort, performance
ISS simulator
Spike
https://github.com/pulp-platform/ariane
Cache line access racing
Bugs found
LoadStoreLoadLoad
SSTATUS
MSTATUS
mxr ...
mxr ...
wr rd
Issu
e
LSU
ALU
...
Multiplier
Fence
PT 1
PT 0 PT 2
PT 3
PT 4
Load Branch Add ... Mult
privileged CSR access FENCE operation failure
page fault handling Incorrect branch execution
MULHSU
ALU corner case bug
Build ittogether.It’s just the beginning ...More instruction extensions support F/V/APerformance verification suiteSecurity verificationCoverage model...
Planned release date: 01/2019Please sign up Google group “riscv-dv” for further updatehttps://groups.google.com/forum/#!forum/riscv-dv
Reference
● riscv-tests● riscv-torture● Ariane core specification● RI5CY core specification● Merline core specification● UVM (Universal Verification Methodology)
https://github.com/riscv/riscv-testshttps://github.com/ucb-bar/riscv-torturehttps://pulp-platform.github.io/ariane/docs/home/https://www.pulp-platform.org/docs/ri5cy_user_manual.pdfhttps://github.com/origintfj/Merlinhttps://workspace.accellera.org/downloads/standards/uvm